Uploaded image for project: 'Jira Software Data Center'
  1. Jira Software Data Center
  2. JSWSERVER-16322

Missing Secure Attribute in Encrypted Session Cookie

XMLWordPrintable

    • Icon: Suggestion Suggestion
    • Resolution: Won't Fix
    • None
    • None
    • None
    • We collect Jira feedback from various sources, and we evaluate what we've collected when planning our product roadmap. To understand how this piece of feedback will be reviewed, see our Implementation of New Features Policy.

      Hi Atlassian Team,

      we had a Pentest and would like to know how to deal with the following results and what type of Support we can have (if any) from Atlassian in here:

      Application Error
      forging a request that contains parameters or parameter values other than the ones expected by the application
             		 Check incoming requests for the presence of all expected parameters and values. http://cwe.mitre.org/data/definitions/550.html
      Missing Secure Attribute in Encrypted Session Cookie Basically the only required attribute for the cookie is the "name" field. Common optional attributes are: "comment", "domain", "path", etc. The "secure" attribute must be set accordingly in order to prevent to cookie from being sent unencrypted. RFC 2965 states: "The Secure attribute (with no value) directs the user agent to use only (unspecified) secure means to contact the origin server whenever it sends back this cookie, to protect the confidentially and authenticity of the information in the cookie." For further reference please see the HTTP State Management Mechanism RFC 2965 at: http://www.ietf.org/rfc/rfc2965.txt and for "Best current practice" for use of HTTP State Management please see http://tools.ietf.org/html/rfc2964 CWE-522 http://cwe.mitre.org/data/definitions/522.html, CWE-718 http://cwe.mitre.org/data/definitions/718.html, CWE-724 http://cwe.mitre.org/data/definitions/724.html, CWE-928 http://cwe.mitre.org/data/definitions/928.html, CWE-930 http://cwe.mitre.org/data/definitions/930.html, PCIDSS-6.5.10

          Form Name

            [JSWSERVER-16322] Missing Secure Attribute in Encrypted Session Cookie

            Gosia Kowalska made changes -
            Resolution New: Won't Fix [ 2 ]
            Status Original: Gathering Interest [ 11772 ] New: Closed [ 6 ]

            Gosia Kowalska added a comment -
            Atlassian Update – 27 September 2019

            Hi,

            Thank you for raising this suggestion. We regret to inform you that due to limited demand, we have no plans to implement it in the foreseeable future. In order to set expectations, we're closing this request.

            This is an automated update triggered by low user engagement with this suggestion (number of votes, number of watchers).

            We hope you will appreciate our candid and transparent communication and our attempts to become more transparent about our priorities. Making tradeoffs and saying no is never an easy task to perform. You can read more about our approach to highly voted server suggestions here.

            To learn more about our recent investments in Jira Server and Data Center, please check our two new dashboards containing Recently resolved issues and Current work and future plans.

            Regards,
            Jira Server and Data Center Product Management

            Gosia Kowalska added a comment - Atlassian Update – 27 September 2019 Hi, Thank you for raising this suggestion. We regret to inform you that due to limited demand, we have no plans to implement it in the foreseeable future. In order to set expectations, we're closing this request. This is an automated update triggered by low user engagement with this suggestion (number of votes, number of watchers). We hope you will appreciate our candid and transparent communication and our attempts to become more transparent about our priorities. Making tradeoffs and saying no is never an easy task to perform. You can read more about our approach to highly voted server suggestions here . To learn more about our recent investments in Jira Server and Data Center, please check our two new dashboards containing Recently resolved issues and Current work and future plans . Regards, Jira Server and Data Center Product Management
            Katherine Yabut made changes -
            Workflow Original: JAC Suggestion Workflow [ 3069625 ] New: JAC Suggestion Workflow 3 [ 3662624 ]
            Owen made changes -
            Workflow Original: Confluence Workflow - Public Facing v4 [ 2622839 ] New: JAC Suggestion Workflow [ 3069625 ]
            Rachel Lin (Inactive) made changes -
            Workflow Original: JIRA PM Feature Request Workflow v2 - TEMP [ 2500951 ] New: Confluence Workflow - Public Facing v4 [ 2622839 ]
            Status Original: Open [ 1 ] New: Gathering Interest [ 11772 ]
            Patrick Bisdorff created issue -

              Unassigned Unassigned
              54597179330e Patrick Bisdorff
              Votes:
              0 Vote for this issue
              Watchers:
              3 Start watching this issue

                Created:
                Updated:
                Resolved: